Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related) (ISSUE 5)

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 26 Sep 2002 10:12:31 -0500

Please se comments inline.

Regards;
Ahmad Muhanna

Non-editorial comments associated with RFC3012bis:

Please post your comments with the appropriate issue number in the subject
line (instead of simply replying to this email).

-Chairs.

5. Section 3.2
   "attempting to replay a previous advertisement and authentication.  If
   the challenge extension is needed and does not exist, the Foreign"
   What does "needed" mean here? That the FA has a policy knob whether
   or not it is needed? Or something else?

Yes, let us read the whole paragraph as in section 3.2. to understand the
policy:

"   Upon receipt of the Registration Request, if the Foreign Agent has
   issued a Challenge as part of its Agent Advertisements, and it
   does not have a security association with the mobile node, then
   the Foreign Agent SHOULD check that the Mobile-Foreign Challenge
   extension exists, and that it contains a challenge value previously
   unused by the Mobile Node.  This ensures that the mobile node is not
   attempting to replay a previous advertisement and authentication.  If
   the challenge extension is needed and does not exist, the Foreign
   Agent MUST send a Registration Reply to the mobile node with the Code
   value MISSING_CHALLENGE.
"

Restrictions, or conditions, or Policy:
1. If the FA has issued a Challenge, in other words, it supports the MN-FA
Challenge, 
2. If the FA does not have a security association with the MN,
3. If the FA receives a RRQ from this MN, 

The Foreign Agent SHOULD check the presence of MN-FA Challenge extension.
However, I suggest changing this to a "MUST". 

Because, this "MUST" is applicable ONLY with the above three conditions.
" No problem with the FA backward compatibility nor with Forward
compatibility
related to dynamically establishing a SA between the MN and the FA"  

Also, to be consistent with the restrictions on the MN, that it 
MUST include MN-FA Challenge extension when it does not have a 
security association with the FA.

Regards,
Ahmad